Privacy Policy

TICKTS LTD (Company No. 17029682), registered at 124-128 City Road, London, EC1V 2NX (“we”, “us”, “our”) is the data controller for personal data collected through the Tickts platform. We are registered with the Information Commissioner’s Office (ICO) under registration reference ZC108275. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform.

1. What We Collect

We collect the following types of personal information:

• Account Information: Name, email address, password (stored as a one-way hash , we never store plain-text passwords), and phone number (optional) when you create an account. If you sign in using Google or Apple, we receive your name and email address from the provider. We do not receive or store your Google or Apple password.
• Profile Information: Organisation name, club details, social media links, and profile images for Organiser accounts.
• Payment Account Information: If you are an Organiser, the identifier and status of the Stripe or PayPal account you connect to receive your ticket money, and when you connected it and when it became able to take payments, so we can send buyers’ payments to you and help you finish setting up.
• Transaction Information: Details of tickets purchased, payment amounts, order history, and payment plan records. We do not store full payment card details , these are handled securely by Stripe.
• Gift Aid Declarations: Where you donate to a verified charity through the Platform and choose to Gift Aid your donation, we collect your name, home address, postcode, and your declaration that you are a UK taxpayer, so the charity can claim Gift Aid from HMRC. This is additional information beyond an ordinary ticket purchase.
• Waitlist and Sign-up Information: If you join the waitlist for an event, we collect your email address, your name if you give it and, where the organiser asks for one, a phone number, which is always optional there. If you sign up on an organiser’s own sign-up page (a page for registering interest before tickets go on sale), we collect what that organiser asks for: your email address, usually your name, a phone number if they ask for one, and your answers to any questions they have added. Where the page has a consent tick box, we keep the wording you were shown and the time you agreed to it. The organiser can see these details so they can contact you as they described when you signed up, for example to offer you a place or to tell you when tickets go on sale. If you arrived through a link shared by one of the organiser’s reps (promoters) or through one of their tracking links, we record which rep or link brought you. An organiser can choose to let each rep see the people who signed up through that rep’s own link; where they have, the form tells you, before you sign up, that the rep will see your details, and a rep is never shown anyone who was not told (see Section 5).
• Scanning & Attendance Data: Ticket scan logs including scan time, location (venue), scanning device, and scan result (valid/invalid/already scanned).
• Consent Records: Cookie consent preferences, consent timestamps, and SHA256-hashed IP and user agent for compliance purposes.
• Administrative Activity Logs: If you have an Organiser account, we record state-changing actions you take in your dashboard (route, IP address, user agent, the names of form fields you changed, and field-level diffs of records you edited) for up to 30 days, to support security, debugging, and dispute resolution. Sensitive form values (passwords, payment fields, CSRF tokens) are redacted at capture.
• Administrative Actions by Tickts: Where Tickts staff perform a privileged action against your account (for example, support-led impersonation, manual refund, account suspension), we record the action, the staff member, the time, and the affected account. If you are an Organiser and a member of staff signs in as you for support purposes, you receive an email notification.
• Usage Data: Information about how you interact with our platform, including pages visited, features used, and time spent on the site.
• Device Information: IP address, browser type, operating system, and device identifiers.
• Tracking and Rep Links: If you arrive via an organiser’s tracking (affiliate) link, we record the link’s code, your IP address, and user agent to attribute the referral. If you arrive via a rep’s link, we count the visit against that rep and the event it opened; we do not store your IP address for this (a scrambled form of it is held for up to an hour, only so the same visit is not counted twice). In both cases, if you have accepted cookies, a cookie remembers the link for 30 days (see our Cookie Policy); if you have not, we remember it for your current visit only, without storing anything on your device for it. Either way, a sign-up or purchase you make in that time can be credited to the rep or link that brought you. If you signed up to an organiser’s waitlist or sign-up page through a rep’s link and later buy a ticket from that organiser without a rep’s link, we use the email address on your order to credit that rep with the sale, for up to 90 days after you signed up. This affects only who the organiser pays commission to; it does not change the price you pay or what you see.
• Communications: Any messages you send to us through our contact form or support channels.
• Incomplete Checkouts: If you start a checkout and provide your email address but do not complete the purchase, we keep your email and a snapshot of your basket so we can send you a single reminder (see Section 4). You can opt out via the link in that email, and we suppress future reminders permanently.
• App Device Tokens: If you use the tickts mobile app and allow notifications, we store a push-notification token for your device (platform and last-used date) so we can deliver notifications you have enabled.
• Accessibility & Access Requirements: Where an Event asks for them, any access or accessibility requirements you choose to enter at checkout (a free-text field, up to 1,000 characters) so the Organiser can accommodate you. Because this may reveal information about your health or disability, we treat it as special-category data and process it only with your explicit consent (see Section 2a). It is optional; leaving it blank does not affect your purchase.
• Saved Cards for Call Dibs and Pledges: If you use Call Dibs (reserving a place on a sold-out Event) or a Make-it-happen Pledge, you save a card via Stripe (a Stripe SetupIntent) so it can be charged later if a place opens or the Event is confirmed. As with every payment, we do not store your card details: Stripe holds the saved card, and we hold only a reference to it and its status.

2. Lawful Basis for Processing

We process your personal data on the following lawful bases under Article 6 of the UK GDPR:

• Contract (Art. 6(1)(b)): Processing your account registration, ticket purchases, order fulfilment, ticket delivery, payment plan administration, ticket transfers, and season pass management.
• Legitimate Interests (Art. 6(1)(f)): Platform security and fraud prevention, analytics and performance monitoring, affiliate and rep tracking (crediting a sign-up or sale to the link or rep that brought you), improving our services, communicating service updates, and contacting organisations that run events at the business email addresses they publish, to tell them about tickts (see Section 5b).
• Legal Obligation (Art. 6(1)(c)): Retaining transaction records for financial compliance (HMRC requirements), responding to law enforcement requests, maintaining audit and consent logs, and processing Gift Aid declarations to meet HMRC Gift Aid requirements (where the charity is the controller, on its lawful basis).
• Consent (Art. 6(1)(a)): Setting analytics and advertising cookies (Google Analytics, Meta, TikTok), setting the cookies that remember a tracking or rep link for 30 days, server-side conversion measurement to those advertising platforms, sending marketing emails to people who have signed up with us, and sharing your data with third parties for purposes beyond service delivery.

2a. Special-Category Data (Article 9)

Where you choose to provide access or accessibility requirements at checkout, that information may reveal data about your health or disability, which is “special-category” data under Article 9 of the UK GDPR. We process it only on the basis of your explicit consent (Article 9(2)(a)), given by choosing to enter it, and solely to pass it to the Organiser so they can make reasonable accommodations for you at the Event. It is optional, is shared only with the Organiser of that Event (who becomes an independent controller for it), and you can ask us or the Organiser to delete it at any time. We do not use it for any other purpose, and we do not process special-category data on a large scale.

3. Cookies

We use cookies and similar tracking technologies to enhance your experience on our platform. For detailed information about the cookies we use and the purposes for which we use them, please see our Cookie Policy.

4. Third Parties & Sub-Processors

We share your information with the following third parties who act as sub-processors or independent controllers:

Provider	Purpose	Data Shared	Location
Stripe	Payment processing (Stripe Connect)	Payment details, name, email, transaction data	US (EU SCCs)
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment processing where the Organiser takes payment through PayPal (the Organiser is the merchant of record)	Name, email, transaction data, IP address	EU (Luxembourg)
TicketPlan	Optional refund-protection product offered at checkout (policy administration and claim handling)	Name, email, ticket details, event name and date	UK
Google Analytics (GA4) & Measurement Protocol	Website analytics and performance monitoring; where an Organiser has enabled it, server-side purchase measurement (Measurement Protocol)	IP address (anonymised), usage data, device info; for a completed purchase where enabled, a SHA-256 hashed email address (Measurement Protocol)	US (EU SCCs)
Brevo (Sendinblue)	Transactional and marketing email delivery, including open and click tracking via embedded pixels and link rewriting	Name, email address, email engagement events (opens, clicks, bounces)	EU
Sentry	Error monitoring and crash reporting	Error data, IP address, browser info	US (EU SCCs)
Cloudflare	CDN, DDoS protection, DNS	IP address, request metadata	Global (EU SCCs)
Apple Wallet	Digital wallet ticket passes	Ticket data (event name, date, venue), attendee name where provided, barcode token, PassKit metadata for lock-screen previews	US (EU SCCs)
Google Wallet	Digital wallet ticket passes	Ticket data (event name, date, venue), attendee name where provided, barcode token, Google Wallet metadata for lock-screen previews	US (EU SCCs)
Google Places API	Venue address lookup and validation	Search queries, location data	US (EU SCCs)
Google OAuth	Social sign-in (“Continue with Google”)	Name, email address	US (EU SCCs)
Apple Sign-In	Social sign-in (“Continue with Apple”)	Name, email address (user may choose to hide email)	US (EU SCCs)
Google reCAPTCHA v3	Bot detection and fraud prevention during registration	IP address, browser behaviour, device data	US (EU SCCs)
Meta (Facebook) Pixel & Conversions API	Conversion tracking and advertising attribution, in-browser (Pixel) and server-side (Conversions API); consent required	Page views and device info (Pixel); for a completed purchase, a SHA-256 hashed email address and your IP address (Conversions API)	US (EU SCCs)
TikTok Pixel & Events API	Conversion tracking and advertising attribution, in-browser (Pixel) and server-side (Events API); consent required	Page views and device info (Pixel); for a completed purchase, a SHA-256 hashed email address and your IP address (Events API)	US / Singapore (SCCs)
Companies House	Business identity verification for Organiser accounts	Company registration number, business name	UK
Cloudways (DigitalOcean)	Application hosting and managed cloud infrastructure	All data stored on the Platform (encrypted at rest)	UK / EU (London region)
Anthropic (Claude)	AI writing assistance for Organisers (improving event descriptions) and Organiser AI tooling	Event details and draft text the Organiser submits; not used to train Anthropic’s models	US (UK IDTA / SCCs)
Klarna / Clearpay	Optional buy-now-pay-later payment methods offered through Stripe at checkout	Payment and eligibility data you provide to the provider if you choose that payment method	EU / US (via Stripe)
Stay22	Accommodation map embedded on some event pages	IP address and page context if you interact with the map	Canada (UK adequacy)
Mailchimp (Intuit)	Optional Organiser integration: where an Organiser connects their own Mailchimp account, their buyers’ details sync to that Organiser’s audience (Organiser-directed; the Organiser is the controller)	Name, email, order context	US (UK IDTA / SCCs)

Server-side conversion measurement. Where an Organiser has enabled it and you have accepted advertising cookies, we send a record of a completed purchase directly from our server to Meta, Google, and/or TikTok to measure the effectiveness of that Organiser’s advertising. This mirrors, and is de-duplicated with, the in-browser pixels. These server-side events contain a SHA-256 hashed (pseudonymised) email address and, for Meta and TikTok, your IP address; they never include your name in the clear or your payment card details. It happens only with your advertising-cookie consent, and not at all for Organisers who have not set it up. Meta, Google, and TikTok act as independent controllers for the advertising measurement they perform with this data, under their own privacy policies.

Email engagement tracking. Email open and click events captured by Brevo are stored against your account for marketing-performance reporting. You can opt out of marketing emails at any time via the unsubscribe link in any marketing email, which also stops engagement tracking for future sends. Transactional emails (order confirmations, password resets, payment-plan notices, ticket-transfer notifications) do not carry a marketing-opt-out and are sent under contractual lawful basis.

Checkout reminder emails. If you start a checkout, provide your email address, and do not complete the purchase, we may send you a single reminder email about that basket (relying on the soft opt-in for electronic marketing, since you provided your details in the course of a sale). We send at most one reminder per event, it contains an opt-out link, and opting out suppresses all future reminders to your address.

Sub-processor changes. The current list of sub-processors is the list above. We will update this list when we add or replace a sub-processor. Organisers acting as data controllers may object to a new sub-processor on reasonable data-protection grounds by emailing [email protected].

5. Organiser Data Sharing

When you purchase a ticket, the Organiser of that event will receive your name, email address, and order details. This is necessary for the Organiser to fulfil the ticket, manage event entry (including QR code scanning), and communicate essential event information to you.

Organisers act as independent data controllers for the buyer data they receive and are responsible for their own compliance with data protection law. We require Organisers to handle buyer data in accordance with our Organiser Terms, but we are not responsible for their data processing practices.

Waitlists and sign-up pages. When you join an event’s waitlist or sign up on an Organiser’s sign-up page, you are signing up to that Organiser. The Organiser receives the details you give and is the data controller for them, relying on its own lawful basis (your consent, where the page asks for it); tickts hosts the page and stores the details on the Organiser’s behalf as its processor. A sign-up page shows the Organiser’s own questions, consent wording and terms, which the Organiser writes and is responsible for. To be removed from an Organiser’s list, or to ask what they hold about you, contact the Organiser, or contact us and we will pass your request on and help them act on it.

Reps (promoters). Some Organisers use reps to promote their events. A rep always sees their own totals (how many people opened their link, signed up or bought). A rep sees the name, contact details and answers of a person who signed up through their link only where the Organiser has switched that on and the form told that person, before they signed up, that the rep would see their details. The details are shared so the rep can follow up with you about that Organiser’s events. The rep acts for the Organiser, must accept our Rep data terms before seeing anyone’s details, and loses access as soon as the Organiser switches the setting off. Reps are never shown the details of ticket buyers through this setting.

If you are a rep. The Organiser you rep for can keep a phone number, an Instagram handle and notes about you, to reach you about your link. The Organiser is the controller of those details. They are seen by the Organiser and, if you are in a head rep’s team, by your head rep, who must first agree to the team section of the Rep data terms. Other reps never see them, and neither does any other Organiser you rep for. You can see and change your own phone number and Instagram on your rep dashboard. We also record when your link was last opened and used, so the Organiser and your head rep can see who is active and be alerted when a rep has gone quiet; nothing happens to you automatically as a result. If the Organiser switches on a team leaderboard, your first name and the tickets you have sold for the team are shown to the rest of your team only, and you can take yourself off it. An Organiser can also make a private spreadsheet link to their reps’ numbers; it contains names and numbers only, never an email address, phone number or note.

Organiser analytics on event pages. Organisers on paid plans can connect their own Google Analytics property or Meta Pixel to their event pages and checkout confirmation. These fire only if you have consented to analytics or marketing cookies, and the data they collect goes to the Organiser (and Google or Meta) under the Organiser’s own privacy notice, with the Organiser as controller.

Organiser-directed integrations (API, webhooks and Zapier). Organisers on paid plans can connect their events to their own tools using our developer API, webhooks, or Zapier. Where an Organiser does this, order data about their buyers (such as name, email address, and order details) is sent, at the Organiser’s direction, to the endpoint or third-party service the Organiser has configured (for example their own CRM, spreadsheet, or automation). That onward transfer is directed and controlled by the Organiser as the data controller, under the Organiser’s own privacy notice and its arrangements with any tool it uses; tickts transmits the data on the Organiser’s instructions as processor and is not responsible for how the receiving tool handles it. This sharing only happens where an Organiser has set up such an integration for their events.

Where you make a donation to a charity Organiser and choose to Gift Aid it, your name and home address are shared with that charity so it can claim Gift Aid from HMRC. The charity is the data controller for that Gift Aid data and is responsible for making the HMRC claim and retaining the declaration records; tickts processes the data on the charity’s behalf.

5a. Ticket Resale

If you list or sell a ticket through our fan-to-fan resale feature, we process your name, email address and the resale transaction in order to operate the resale, transfer the ticket and pay you. To receive your funds you connect a Stripe Express payout account; Stripe collects and verifies the identity and bank details it needs to pay you (including, where required by law, identity-verification information) as part of that process. Stripe acts as our payment sub-processor for this, as set out in Section 4. Where an Organiser has chosen to take payment through PayPal, your name, email address and the transaction are shared with PayPal so that it can process the payment to that Organiser; PayPal processes that data under its own privacy statement as well. When you buy a resale ticket, the seller does not receive your personal data; the handover and a fresh ticket are issued to you automatically by the Platform.

5b. Contacting Organisations About Tickts

We sometimes email clubs, venues, schools, charities, businesses and other organisations that run events, to tell them about tickts. This section explains how that works.

• Where we get the details: From information the organisation has published, such as its own website and public listings or directories of venues, clubs and events. Collection is partly automated.
• What we hold: The organisation’s name and published email address and, where published, its phone number, town or postcode and website; the type of organisation; the result of a check that the email address can receive email; and a record of the emails we have sent and whether they were opened or clicked (see Brevo in Section 4).
• Lawful basis: Legitimate interests (Art. 6(1)(f)): telling organisations that run events about a ticketing service relevant to them. We aim to use business addresses only. If we hold a personal address for you, or an address that is not connected with the organisation, tell us and we will delete it and not contact you again.
• Your choices: Every email has an unsubscribe link, and you can also reply to it or write to [email protected]. When you opt out, we add your address to a do-not-contact list so that you are not emailed again.
• Who sees it: Brevo, which sends our emails, and Microsoft, which hosts our mailbox. We do not sell these details or share them with anyone else.
• How long we keep it: Up to 2 years after our last email to you, unless your organisation becomes a tickts customer. The do-not-contact list is kept for as long as we send these emails, holding only what we need to honour your opt-out.

6. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you. You can export your data from your account settings at any time.
• Right to Rectification: You can request that we correct any inaccurate or incomplete personal data. You can update most information directly in your account settings.
• Right to Erasure: You can request deletion of your account from your account settings. Where you have no transaction history, your account is permanently deleted. Where you have transaction history (as a buyer or Organiser), your account is anonymised rather than hard-deleted: your name is replaced with “Deleted User”, your email is replaced with a non-routable placeholder, your password and two-factor credentials are removed, and any connected Stripe, social-login, and billing identifiers are cleared. The underlying transaction, ticket, scan, and order records remain in their original form to satisfy HMRC retention and to allow refund and dispute resolution for buyers. Organisers cannot close their account while they have upcoming events with sold tickets, or within 90 days of their most recent transaction.
• Right to Restrict Processing: You can request that we limit how we use your personal data.
• Right to Data Portability: You can request a copy of your data in a structured, commonly used, machine-readable format (JSON).
• Right to Object: You can object to the processing of your personal data for certain purposes, including direct marketing.
• Right to Withdraw Consent: Where processing is based on consent (e.g., analytics cookies or marketing emails), you can withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month. If we need more time (up to two additional months for complex requests), we will inform you within the first month.

7. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Our fraud detection measures may involve automated checks, but these are always subject to human review before any action is taken on your account.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our services. We may also retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Specifically:

• Account data: Retained for the lifetime of your account and for up to 2 years after account closure.
• Transaction data: Retained for 7 years to comply with HMRC financial record-keeping requirements.
• Deleted accounts: Personal data is anonymised immediately upon deletion. Transaction records, order history, and event data are retained for 7 years (HMRC compliance).
• Gift Aid declaration records: Retained in line with HMRC requirements. The charity Organiser is the controller for this data and is responsible for meeting that record-keeping obligation; tickts retains the records on its behalf.
• Usage and analytics data: Retained for up to 26 months.
• Scan logs: Retained for 2 years for dispute-resolution and Platform-integrity purposes.
• Waitlist and sign-up records: An entry on an event’s waitlist is deleted 90 days after the event date it was for. A sign-up on an Organiser’s sign-up page is deleted 24 months after you signed up. The Organiser can remove you sooner, and you can ask the Organiser or us to remove you at any time. After deletion we keep only a count of how many sign-ups a rep or link brought, with nothing that identifies you. An Organiser may have exported their list before then; they are the controller for any copy they hold.
• Rep contact details and notes: Kept while you are a rep for that Organiser, and deleted automatically 12 months after your rep link was last paused.
• Support communications: Retained for up to 3 years after the last interaction.
• Business outreach contact details: Retained for up to 2 years after our last email, then deleted (see Section 5b). Do-not-contact entries are kept for as long as we send outreach emails.
• Data-protection requests and complaints: Retained for 6 years after the request or complaint is closed.
• Consent records (cookies, marketing): Retained for 2 years (automatically purged).
• Organiser administrative activity logs: Retained for 30 days, then automatically purged.
• Migration audit logs (record of an Organiser’s confirmation that they own content imported via the “switch from” tool): Retained for 6 years from the date of import to defend against potential third-party claims relating to imported content.
• Error and security logs: Retained for up to 90 days, except where investigation is ongoing.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. This includes:

• Encryption in transit (TLS/SSL) for all data transmitted to and from the Platform;
• Secure password hashing using bcrypt;
• Regular security reviews and vulnerability assessments;
• Access controls limiting employee and system access to personal data;
• Cloudflare DDoS protection and Web Application Firewall (WAF);
• Optional two-factor authentication (TOTP) with single-use recovery codes; secrets are stored encrypted at rest.

10. International Transfers

Some of our sub-processors (Stripe, Google, Sentry, Apple, Meta, TikTok, Cloudflare) are based in or operate from the United States (TikTok also from Singapore). Application data itself is hosted in the United Kingdom on Cloudways/DigitalOcean (London region). Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place under Article 46 of the UK GDPR, including the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or reliance on the recipient’s participation in a recognised adequacy framework (for example, the UK extension to the EU-US Data Privacy Framework where applicable).

You can request a summary of the transfer mechanism in place for any specific sub-processor by emailing [email protected].

11. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR. Where the breach is likely to result in a high risk to your rights, we will also notify you directly without undue delay.

12. Children’s Privacy

Our Platform is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child under 16, please contact us immediately and we will take steps to delete it.

13. Contact & Complaints

We are not required to appoint a statutory Data Protection Officer under UK GDPR Article 37 because we are not a public authority and our core activities do not consist of large-scale monitoring of individuals or large-scale processing of special-category data. Although we process limited special-category data where you voluntarily provide access or accessibility requirements (see Section 2a), this is optional, occasional, and not on a large scale, so no statutory Data Protection Officer is required. All privacy queries are handled by the Tickts privacy team at the contact below, who acts as our data protection point of contact.

If you have any questions about this Privacy Policy or our data practices, or if you wish to exercise your data rights or make a complaint, please contact us:

• Email: [email protected]
• Post: TICKTS LTD, 124-128 City Road, London, EC1V 2NX

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data protection rights have been violated. Our ICO registration reference is ZC108275. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.